Ask a room of health-tech founders whether HIPAA applies to them and half will say yes automatically and half will say no. HHS's own framing is narrower than the first group assumes and stricter than the second hopes: the HIPAA Rules apply to covered entities and business associates. Everyone else is outside them.
The three covered entity categories
A covered entity is one of three things. First, a health plan - health insurance companies, HMOs, company health plans, and government programs that pay for health care such as Medicare, Medicaid and the military and veterans health care programs. Second, a health care clearinghouse - entities that process nonstandard health information they receive from another entity into a standard format, or vice versa. Third, a health care provider - doctors, clinics, psychologists, dentists, chiropractors, nursing homes, pharmacies and the like - but only if they transmit information in electronic form in connection with a transaction for which HHS has adopted a standard, such as electronic billing.
HHS offers a decision tool that walks an organization through whether it meets the definition; the underlying definitions of "covered entity" and "business associate" live in the regulation at 45 CFR 160.103.
Where startups usually land
A consumer app that collects health information directly from its users - a period tracker, a fitness log, a meditation product - is generally none of the three categories. HHS states plainly that if an entity does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules. That does not mean unregulated; it means HIPAA is not the regime that applies.
The picture changes the moment you sell to the health care system. If a covered entity engages your company to help carry out its health care activities and functions, and the work involves protected health information, you become a business associate. The covered entity must then have a written contract with you - a business associate agreement - that establishes specifically what you have been engaged to do and requires you to protect the privacy and security of that information. And the obligation is not just contractual: HHS notes that business associates are directly liable for compliance with certain provisions of the HIPAA Rules themselves.
Decide before you build
Covered entities themselves carry the full weight of the Rules: they must protect the privacy and security of health information and provide individuals certain rights with respect to it. Their contracts push matching duties downstream - HHS requires the written arrangement with a business associate to establish specifically what the associate has been engaged to do and to require it to protect the privacy and security of the information, not just to gesture at compliance in general terms.
The practical fork is architectural. Consumer-direct products store data users give them under their own privacy promises; business-associate products inherit a federal rulebook covering safeguards, breach duties and subcontractor flow-downs. Founders who assume HIPAA never applies get surprised by the first hospital contract; founders who assume it always applies build compliance machinery their direct-to-consumer product never needed. Run the HHS decision tool, and when a covered entity customer appears, read the business associate agreement before you sign it - it defines what you were "engaged to do," which defines your exposure.